diff options
| author | Gary Guo <gary@garyguo.net> | 2026-07-07 13:26:46 +0100 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2026-07-10 15:16:07 +0200 |
| commit | ef8154d8b52d60338c1fd8d793cd8e891c604c14 (patch) | |
| tree | bf6b7db3e01c842a872a72278f2adecb6e886302 /include | |
| parent | eb6cd6d3d8abeac5d7e8251b898067184afdad8a (diff) | |
| download | linux-stable-ef8154d8b52d60338c1fd8d793cd8e891c604c14.tar.gz linux-stable-ef8154d8b52d60338c1fd8d793cd8e891c604c14.zip | |
usb: fix UAF when probe runs concurrent to dyn ID removal
Dynamic IDs are only guaranteed to be valid when usb_dynids_lock is held,
as remove_id_store can free the node. Thus, make a copy in
usb_probe_interface. Clarify the documentation that the id parameter is
only valid during the probe.
USB serial has the same pattern, but it does not need fixing as the IDs
cannot be removed via sysfs.
Fixes: 0c7a2b72746a ("USB: add remove_id sysfs attr for usb drivers")
Signed-off-by: Gary Guo <gary@garyguo.net>
Reviewed-by: Danilo Krummrich <dakr@kernel.org>
Link: https://patch.msgid.link/20260707-usb_dyn_id_uaf-v2-7-632dcf3adfba@garyguo.net
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'include')
| -rw-r--r-- | include/linux/usb.h | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/include/linux/usb.h b/include/linux/usb.h index 25a203ac7a7e..83ff8e2c391d 100644 --- a/include/linux/usb.h +++ b/include/linux/usb.h @@ -1185,7 +1185,8 @@ extern ssize_t usb_show_dynids(struct usb_dynids *dynids, char *buf); * interface. It may also use usb_set_interface() to specify the * appropriate altsetting. If unwilling to manage the interface, * return -ENODEV, if genuine IO errors occurred, an appropriate - * negative errno value. + * negative errno value. The usb_device_id parameter is only valid during + * probe. * @disconnect: Called when the interface is no longer accessible, usually * because its device has been (or is being) disconnected or the * driver module is being unloaded. |